Legal Services Agents: Privilege, Confidentiality, And The Pact That Keeps Them Both

TL;DR

Attorney-client privilege is the legal profession's strongest evidentiary protection. It applies to confidential communications between client and counsel for the purpose of obtaining legal advice. An agent that participates in those communications without enforcing privilege correctly can break it. Privilege broken once is broken forever — the communications become discoverable, the client's legal strategy becomes visible to opposing counsel, and the malpractice exposure becomes large. A pact-bound legal agent enforces privilege at runtime through three mechanisms: scoped data access that prevents privileged content from leaking outside the privileged channel, attestation that proves the agent operated within privilege boundaries, and human-counsel oversight for any decision that touches the privilege boundary. This essay walks the privilege-preserving pact pattern and the architecture that supports it.

The privilege break that ended a relationship

A mid-sized firm deploys an agent to help associates with research. The agent has access to the firm's document management system, including matter folders for active client engagements. An associate working on a litigation matter for Client A asks the agent a question that seems generic but actually references specific facts of the matter. The agent, looking for context, retrieves relevant documents from the matter folder, summarizes them, and includes the summary in its response. The summary contains content that is privileged.

Weeks later, in discovery for an unrelated matter for Client B, opposing counsel issues a request for all communications involving the agent. The firm's e-discovery team produces the records, including the agent's responses to associates. The Client A summary surfaces. Opposing counsel for Client B has now seen privileged content from Client A. Privilege is broken; the content is discoverable; Client A's litigation position is compromised; the firm's malpractice exposure is enormous.

This story has not happened publicly with any major firm yet. It will. The conditions for it are present at every firm that has deployed an agent without privilege-enforcing controls. The pattern of "agent has access to privileged content; agent's outputs are not themselves protected; agent's outputs end up in discoverable contexts" is the modal failure mode for legal agents that lack privilege discipline.

What the pact has to enforce

A privilege-preserving pact for a legal agent has to enforce four things at runtime, not in policy.

First, scoped data access. The agent can read content from a privileged matter only when operating in a context that is itself privileged. Cross-matter retrieval is forbidden by default; an agent serving Client A's matter cannot retrieve Client B's documents even if asked. The pact's scope predicate names the matter the agent is operating on; the runtime enforces by refusing retrievals outside the named scope.

Second, output containment. The agent's outputs that touch privileged content are themselves marked as privileged in the firm's systems. They flow only to authorized recipients (the matter team, the supervising attorney) and never to systems outside the privileged channel without explicit attorney review. The pact's output predicate names which destinations are privileged; the runtime enforces by refusing to write to non-privileged destinations.

Third, attestation. The agent produces a per-interaction attestation that names the matter, the requesting attorney, the documents accessed, the output produced, and the recipients. The attestation is itself privileged content held in the firm's privileged audit log. In the event of a privilege challenge, the attestation supports the firm's privilege claim.

Fourth, human oversight at boundaries. Any agent operation that approaches the privilege boundary — a request that could be interpreted as inside or outside the matter scope, an output destination that is borderline, a content classification that is ambiguous — escalates to a human attorney for explicit authorization. The escalation is logged in the attestation.

A pact that names these four enforcement mechanisms turns privilege protection from an aspirational policy into a property of the agent's runtime. A pact that does not is hopeful documentation that will not survive an adversarial discovery.

The work-product doctrine adds a second layer

Privilege protects communications. Work-product doctrine protects materials prepared in anticipation of litigation. The two doctrines overlap but have different scope and different enforcement requirements.

Work product includes the attorney's mental impressions, legal theories, and factual analysis prepared for litigation. An agent that produces work product on behalf of a litigation team produces material that should be marked as work product, contained within the litigation team's access scope, and protected from disclosure absent extraordinary circumstances.

The pact's predicate distinguishes ordinary client communications from work product. Ordinary client communications are bound by privilege rules. Work product is bound by work-product rules, which are slightly more protective and have slightly different exceptions. Both layers apply to legal agents; both have to be in the pact.

The conflict-of-interest layer

Firms have conflict rules. An agent that retrieves content across multiple matters could surface conflicts that the firm's conflict-checking systems missed. An agent that processes matters for clients on opposite sides of a transaction could leak information across the wall.

The pact's enforcement: the agent operates only on matters where the firm has cleared conflicts; the runtime checks the conflict register before granting access; conflicts that arise mid-matter trigger an immediate access freeze and escalation to the firm's conflicts counsel. The pact's renewal cycle includes a conflict re-check.

The agent itself can be a conflict-detection tool. Properly scoped, it can surface conflicts the firm's manual processes missed. Properly unscoped, it is a conflict-creation tool that walks privileged content across walls. The difference is the pact and its runtime enforcement.

The supervising-attorney requirement

Attorneys have professional responsibility for the work product of those acting under their direction. An agent's work product is the supervising attorney's responsibility. The pact has to make supervision real, not nominal.

Real supervision: a named supervising attorney for every matter the agent operates on; the attorney sees every output before it leaves the agent's privileged context; the attorney signs off (or routes to client) on outputs that go to the client; the attorney's review is logged in the attestation.

This is not a formality. State bar disciplinary actions for inadequate supervision of non-lawyer assistants (paralegals, contractors, vendors) are common; the same standards apply when the assistant is software. The pact's supervising-attorney clause is what stands between the firm and a discipline complaint after an agent error.

The discovery and disclosure question

When the firm or the client is in litigation, the existence of the agent and its outputs may be discoverable. The pact's audit trail and attestation should be designed to satisfy reasonable discovery requests without exposing privileged content.

The model: the attestation log is structured so that the existence of an interaction is discoverable (date, attorney, matter scope) but the content of the interaction is privileged and protected. Discovery responses identify the existence of the agent's involvement; privilege logs claim the substance.

A poorly designed attestation either hides too much (looking like the firm is concealing evidence) or exposes too much (making privileged content discoverable). The right design is the same as for any privileged audit log: structure that supports legitimate discovery while protecting the content the privilege covers.

The cross-jurisdictional complication

Privilege rules vary by jurisdiction. US federal common-law privilege differs from state privilege rules; both differ from EU professional secrecy; both differ from English legal professional privilege. An agent operating across jurisdictions must respect the most restrictive applicable privilege regime.

The pact's jurisdiction clause names which privilege regime applies to the matter. The runtime enforces according to that regime. Multi-jurisdictional matters get the most restrictive regime as the default; specific scope adjustments are negotiated per matter.

This is exactly the same discipline that human lawyers apply when operating across jurisdictions. The agent inherits the discipline through its pact configuration.

The named artifact: the Legal Pact Template

A pact template specifically designed for legal agents, with sections for each privilege requirement.

Identification. Matter name and number. Client identifier. Supervising attorney. Engagement letter reference.

Scope. Matter team members authorized to access. Document categories within scope. Cross-matter access restrictions.

Privilege predicate. The privilege regime that applies. The list of recipients within the privileged channel. The conditions under which output may leave the privileged channel (explicit attorney authorization, client copy, etc.).

Work-product predicate. Content categories that constitute work product. Protection rules. Exception conditions.

Conflict predicate. Reference to firm's conflict register. Re-check cadence. Escalation on detected conflict.

Attestation. Required fields per interaction. Audit log destination. Retention period.

Human oversight. Decision categories that require attorney authorization. Escalation procedure. Authorization logging.

Dispute path. The pact's named venue for any dispute about the agent's operation. Typically the firm's general counsel for internal matters; AAA for vendor relationships.

A legal agent operator who fills out this template before deploying an agent has done the privilege engineering correctly. One who has not is shipping a privilege-break-in-waiting.

Counter-argument: "Lawyers will never let agents anywhere near privileged content"

The strongest objection is cultural: the legal profession is conservative, privilege-protective, and skeptical of new technology in privileged contexts. Many lawyers will refuse to allow agents into matter folders regardless of how good the privilege engineering is.

The objection is right that adoption will be slow. It is wrong about the equilibrium. Firms that figure out how to deploy agents safely in matter work will produce work product faster and cheaper than firms that do not. The cost differential will eventually pull firms into adoption regardless of cultural preference, and the firms that adopt with proper privilege engineering will outcompete firms that adopt without it. The cautious firms have the right instinct on caution; the firms that combine caution with disciplined deployment will own the next decade.

What Armalo does

The Armalo registry supports legal-specific pact templates that include privilege predicate, work-product predicate, conflict predicate, and supervising-attorney clauses. The agent runtime enforces scope predicates by refusing cross-matter retrievals; output containment by refusing writes outside named privileged destinations; attestation by producing per-interaction logs to the firm's privileged audit log. Disputes route through the firm's general counsel by default; vendor disputes escalate to AAA. The platform's role is the runtime enforcement and the attestation infrastructure; the firm's role is the matter scoping, conflict register, and supervising-attorney designation.

FAQ

Can the platform itself read privileged content? Architecturally, no. The platform's role is the runtime enforcement; the privileged content lives in the firm's systems and the agent operates against it under the pact's access controls. The platform sees the attestation metadata, not the content.

What if the agent makes a privilege error? The error is logged in the attestation. The firm's privilege response procedure applies: privilege claw-back, supplemental privilege log entries, possible motion practice if opposing counsel has already received the content.

Does the pact replace the firm's existing engagement letter? No. The engagement letter is between firm and client. The pact governs the agent's operation within matters covered by the engagement letter.

Who is the agent's supervising attorney for compliance purposes? Named in the pact, per matter. The same attorney who would supervise a paralegal or contract associate.

What about agents that operate cross-firm in joint defense agreements? The joint defense agreement extends privilege; the pact's recipient list includes the joint defense participants; the runtime enforces accordingly.

Can the agent participate in discovery responses? Only under attorney supervision and within the firm's discovery procedures. Agent-generated discovery responses get the same supervision attorney-generated responses get.

Will state bars accept agent-supervised work as adequately supervised? The standard is reasonable supervision; firms that document the supervision through the attestation should satisfy the standard. The bar's response will evolve with adoption.

Bottom line

Legal agents touching privileged content require runtime enforcement of privilege, work-product protection, conflict rules, and supervising-attorney oversight. A pact that names these enforcements turns privilege protection from policy into property. Firms that ship privileged-content agents without the engineering will produce the first major privilege-break incident; firms that ship with the engineering will own the productivity gains without the malpractice exposure. The pattern is buildable today. The discipline to require it is the part most operators will resist.